Alien Phone Service

In the Quick Settings panel (pull down from the top), modern GrapheneOS versions include the "Privacy and Permission Control" widget. It shows your current privacy status at a glance — and lets you toggle camera, microphone, or location individually with a single tap, without navigating into settings. The widget is hidden by default and must be manually activated in the Quick Settings editor and moved to the top. I set it up and place it front and centre — instantly accessible from the first boot.

The Auditor app uses the Pixel's Titan M2 security chip to cryptographically prove: (1) The device is running genuine, unmodified GrapheneOS. (2) The bootloader is actually locked. (3) In later checks with the same pairing, Auditor reports if any of this has changed. This is a hardware-backed attestation. I run the verification before shipping and include the result. It applies to my pairing, so you cannot recompute it yourself. You can verify it yourself with your own Auditor device or via attestation.app. That creates your own pairing with its own fingerprint, which differs from the one in my proof.

Installing GrapheneOS requires briefly unlocking the bootloader — that's technically unavoidable. After installation it is immediately re-locked, and additionally the "OEM unlocking" toggle in Developer Options is disabled. This prevents anyone with physical access to your device from unlocking the bootloader again and flashing a compromised system. On every boot, the Titan chip verifies that GrapheneOS is unmodified (Verified Boot). If something doesn't match: the device won't start — no exceptions.

Depending on the app, in the same order as in the book: first the GrapheneOS App Store, which comes preinstalled on the device. Then Accrescent, a signature-verified app store that is installed directly from the GrapheneOS App Store. If an app is in neither, it comes via Obtainium directly from the developer's official source, with no store in between. The Zap Store is available on request, F-Droid only when none of the other routes fits. Which route is right for which app is explained in detail in the ebook (Chapter 8, App Strategy).

Don't trust me blindly, verify. The GrapheneOS project does not endorse any vendor of preinstalled devices, including me. Its official recommendation is to buy a supported Pixel and install GrapheneOS yourself. The web installer makes that straightforward, and chapter 4 of the GrapheneOS Handbook walks you through it step by step.

For preinstalled devices, GrapheneOS lists three steps. 1. Verify authenticity: when it boots, the device shows a yellow notice with an ID, the hash of its verified boot key. Pressing the power button pauses the notice. The ID must match the value for your model in the "Verified boot key hash" section of the official installation guide. 2. Reset: factory reset the device from recovery mode before you use it. 3. Set up Auditor: locally with a second device or as remote attestation.

The reset also wipes the setup from Digital Bunker upwards, including all preinstalled apps. GrapheneOS itself stays installed and the bootloader stays locked. So you have a choice. Full control means all three steps, then you set up the device yourself, for example with the GrapheneOS Handbook, and get my apps back via Obtainium or the Zap Store in a few minutes. Verify without reset means steps 1 and 3. That proves the operating system is genuine and the bootloader is locked. Auditor also shows whether accessibility services, device administrators or ADB are enabled. It does not check which apps are installed or what they are allowed to do. For the setup, you then trust me. I include my Auditor proof, but it does not replace your own verification.